Answer in brief
CVE-2025-7043 records a Medium severity (CVSS 5.4) vulnerability in Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption. The current sources do not mark it as known exploited. The current feed maps WSO2/Forgerock Key Manager Component (generic), WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Universal Gateway (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps WSO2/Forgerock Key Manager Component (generic), WSO2/WSO2 API Control Plane (generic), WSO2/WSO2 API Manager (generic), WSO2/WSO2 Universal Gateway (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| WSO2/Forgerock Key Manager Componentgeneric | >=1.0.0 <1.0.0.3 || >=1.0.0 <1.0.0.4 || >=1.1.0 <1.1.0.2 || >=1.1.5 <1.1.5.3 || >=1.1.5 <1.1.5.4 | 1.0.0.3, 1.0.0.4, 1.1.0.2, 1.1.5.3, 1.1.5.4 |
| WSO2/WSO2 API Control Planegeneric | >=4.5.0 <4.5.0.15 | 4.5.0.15 |
| WSO2/WSO2 API Managergeneric | >=3.2.0 <3.2.0.434 || >=3.2.1 <3.2.1.54 || >=4.1.0 <4.1.0.218 || >=4.2.0 <4.2.0.156 || >=4.3.0 <4.3.0.67 || >=4.4.0 <4.4.0.30 || >=4.5.0 <4.5.0.14 | 3.2.0.434, 3.2.1.54, 4.1.0.218, 4.2.0.156, 4.3.0.67, 4.4.0.30, 4.5.0.14 |
| WSO2/WSO2 Universal Gatewaygeneric | >=4.5.0 <4.5.0.14 | 4.5.0.14 |
Published upstream
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 19, 2026
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.
Quoted source text, attributed separately from HOL analysis.